Deep Malware Analysis of 49bd706f689f1067fb5de679cd8acc4e | md5: 49bd706f689f1067fb5de679cd8acc4e | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | Executable | PE (Portable Executable) | PE File Layout | PDB Path

PE File Layout

PDB Path

Malicious

System Volume Information

searchTrigger

Zip Archive

libcrypto.dll

[Authenticode]_681ef6a5.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

RT_MANIFEST

ID:0002

ID:1033

listSettingSpeed

csvNumber

permanentPhotoAction

Исх №6626 Представление на назначение на воинскую должность.pdf

PDF Text Preview (generated)

Text (Preview)

Page #1

#Stream {4}

#Stream {8}

#Stream {12}

#Stream {13}

Structure

resourceHeight

intellijidea.exe

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.buildid

.data

.pdata

.tls

.reloc

initialFeedbackCode

winrar.exe

[Authenticode]_98ba5cdb.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.rsrc

.reloc

Resources

RT_VERSION

ID:0001

ID:1033

RT_MANIFEST

ID:0001

ID:1033

totalParameterGroup.xml

listSettingSpeed.pub

ssh-shellhost.exe

[Authenticode]_a5d98da1.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.rsrc

.reloc

minDocumentMethod

obsstudio.exe

[Authenticode]_d068fa0a.p7b

Structure

DosHeader

PE Header

Optional Header (x64)

Section Headers

.text

.rdata

.data

.pdata

_RDATA

.rsrc

.reloc

temporaryMessageTag.xml

minUrlLength

facebook.exe

PE File Layout

Win 32 Exe

x86

Structure

DosHeader

PE Header

Optional Header (x86)

Section Headers

.text

.rdata

.data

.idata

.symtab

finalSignalLimit